Apparatus and method for secure provisioning of a communication device

ABSTRACT

A system that incorporates the subject disclosure may perform, for example, obtaining programming data via an over-the-air programming message for use by a communication device, wherein the over-the-air programming message is obtained from, and encrypted by an over-the-air programming server. The over-the-air programming message is decrypted utilizing a first keyset obtained by a secure device processor processing the first keyset obtained from a remote management server via transmission by the over-the-air programming server, to generate a first-key decrypted over-the-air programming message. The decrypted over-the-air programming message is provided to a secure element to enable the secure element to further decrypt the first-key decrypted over-the-air programming message utilizing a second keyset, wherein the secure device processor does not have access to the second keyset. Other embodiments are disclosed.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.15/872,622 filed Jan. 16, 2018, which is a continuation of U.S. patentapplication Ser. No. 15/056,441, filed on Feb. 29, 2016, issued as U.S.Pat. No. 9,882,902, which is a continuation of U.S. patent applicationSer. No. 14/070,458 filed Nov. 1, 2013, issued as U.S. Pat. No.9,313,660. The contents of each of the foregoing are hereby incorporatedby reference into this application as if set forth herein in full.

FIELD OF THE DISCLOSURE

The subject disclosure relates to an apparatus and method for secureprovisioning of a communication device.

BACKGROUND

Electronic devices are being utilized with more frequency to conductvarious types of transactions and exchanges of information. Theelectronic devices can be provisioned with programming data, includingan initial provisioning and subsequent provisioning(s). The provisioningcan sometimes include receiving the programming data from a remotesource.

BRIEF DESCRIPTION OF THE DRAWINGS

Reference will now be made to the accompanying drawings, which are notnecessarily drawn to scale, and wherein:

FIG. 1 depicts an illustrative embodiment of a system that enables useof a UICC and a secure device processor as part of a secure servicesplatform for a securely provisioning a communication device;

FIG. 2 depicts an illustrative embodiment of a system including thecommunication device of FIG. 1 implementing authentication andmanagement functions, as well as provisioning functions;

FIGS. 3A-3B depict an illustrative embodiment of a system that can beused for securely providing over-the-air programming of a communicationdevice;

FIGS. 4A-4B depict an illustrative embodiment of a system that can beused for provisioning devices that are engaged in securely providingover-the-air programming of a communication device;

FIGS. 5A-5B depict an illustrative embodiment of a system that can beused for providing secure over-the-air programming of a communicationdevice;

FIG. 6 depicts an illustrative embodiment of a method used in portionsof the systems described in FIGS. 1-5B;

FIG. 7 depicts an illustrative embodiment of a communication system thatprovides media services including secure communication of over-the-airprogramming for a communication device;

FIG. 8 depicts an illustrative embodiment of a communication device thatcan securely communicate messages and responses related to over-the-airprogramming; and

FIG. 9 is a diagrammatic representation of a machine in the form of acomputer system within which a set of instructions, when executed, maycause the machine to perform any one or more of the methods describedherein.

DETAILED DESCRIPTION

The subject disclosure describes, among other things, illustrativeembodiments in which provisioning can be performed for a communicationdevice, such as via Over-The-Air programming (OTA) messages securelydelivered to a communication device(s). The secure delivery can beperformed utilizing authentication and/or encryption based on variouskeysets that are provided to various combinations of devices and/orcomponents. In one embodiment, device-based traffic management forInternet Protocol (IP)-based (e.g., Hypertext Transfer Protocol (HTTP))can be performed. In one embodiment, security mechanisms for HTTP-basedOTA can be provided. In one embodiment, network and/or devicefunctionality may be managed remotely. In one embodiment, support formultiple HTTP-based OTA servers can be provided for securelyprovisioning one or more communication devices via OTA messaging.

In one embodiment, a device-based proxy can be utilized to providetraffic management for HTTP-based OTA messages. In one embodiment, adevice-based proxy and a secure element (e.g., a Universal IntegratedCircuit Card (UICC)) can be utilized to provide security for HTTP-basedOTA messages, such as through authentication and/or encryption. In oneembodiment, a Secure Device Processor (SDP) can be utilized as thedevice-based proxy. In one embodiment, remote management of the deviceand/or network components can be performed. In one embodiment, anadministrative agent key function is provided that may be located in theUICC. In one embodiment, an administrative agent function is loaded intoan SDP of a communication device, such as a mobile smart phone. In oneembodiment, a remote management function can be provided in a remotemanagement server in order to manage (in whole or in part) theadministrative agent function, the administrative agent key function,and/or the transport keys that are distributed, such as to the SDPand/or OTA server(s).

In one or more embodiments, the secure element (e.g., executing theadministrative agent key function), the secure device processor (e.g.,executing the administrative agent function) and/or the device processorcan be separate but in communication with each other. The secure element(e.g., UICC) can be a highly secure computing platform for storingsecrets such as encryption keys and authentication credentials, and canhost and execute applets. The SDP can be a processor that is logicallyand/or physically separate from the device processor (and/or the secureelement), and can offer more security than the device processor, but notas much security as the secure element. Examples of an SDP include aTrusted Execution Environment (TEE) and an embedded Secure Element(eSE). In one or more embodiments, the administrative agent function ofthe SDP in conjunction with the OTA server can provide a secure meansfor delivering messages and response associated with OTA, includingvarious programming data, to the secure element to enable the secureelement to utilize the programming data (e.g., executing softwareupdates, adjusting configuration settings or parameters and so forth).

Other embodiments are included in the subject disclosure.

One embodiment of the subject disclosure is a method includingregistering, by an administrative agent function operating in a securedevice processor of a mobile communication device, an internet protocoladdress with an over-the-air programming server, where the internetprotocol address is associated with the administrative agent function.The method can include receiving, from the over-the-air programmingserver by the administrative agent function, an over-the-air programmingmessage that includes programming data for use by the mobilecommunication device, where the over-the-air programming message isencrypted by the over-the-air programming server, and where theover-the-air programming message utilizes a hypertext transfer protocol.The method can include decrypting, by the administrative agent function,the over-the-air programming message utilizing a first keyset togenerate a decrypted over-the-air programming message. The method caninclude determining, by the administrative agent function, a schedulefor providing messages to a secure element of the mobile communicationdevice, where the secure device processor is separate from the secureelement and in communication with the secure element. The method caninclude providing, by the administrative agent function, the decryptedover-the-air programming message to the secure element according to theschedule.

One embodiment of the subject disclosure is a method that includesreceiving, by a server including a processor, a registration requestincluding an internet protocol address, where the registration requestis received from a secure device processor of a mobile communicationdevice. The method can include encrypting, by the server, anover-the-air programming message utilizing a first keyset to generate anencrypted over-the-air programming message, where the over-the-airprogramming message includes programming data for use by the mobilecommunication device. The method can include providing, by the server,the encrypted over-the-air programming message to the secure deviceprocessor to enable the secure device processor to decrypt the encryptedover-the-air programming message utilizing the first keyset, where theproviding of the encrypted over-the-air programming message furtherenables the secure device processor to provide the programming data to asecure element of the mobile communication device for provisioning ofthe mobile communication device, and wherein the secure device processoris separate from the secure element and in communication with the secureelement.

One embodiment of the subject disclosure is a method that includesreceiving, by a secure element of a mobile communication device, arequest for a first keyset, where the request is received from a securedevice processor of the mobile communication device, and where thesecure element is separate from the secure device processor and incommunication with the secure device processor. The method can includeproviding, by the secure element, the first keyset to the secure deviceprocessor to enable the secure device processor to decrypt anover-the-air programming message to generate a decrypted over-the-airprogramming message, where the over-the-air programming message includesprogramming data for provisioning the mobile communication device. Themethod can include receiving, by the secure element from the securedevice processor, the decrypted over-the-air programming message. Themethod can include performing, by the secure element, an additionaldecryption of the decrypted over-the-air message utilizing a secondkeyset, where the secure device processor does not have access to thesecond keyset.

In accordance with an embodiment of the disclosure, FIG. 1 depicts asystem 100 that includes a communication device 102 connected to orotherwise in communication with a network 122 and provided with a secureservices platform 110 enabling authentication of other communicationdevices, encrypted communication with those devices, and/or securecommunications related to OTA messages. Device 102 can be loaded with anadministrative agent function (e.g., loaded into a secure deviceprocessor 106) and/or an administrative agent key function (e.g., loadedinto a secure element 108) to enable or otherwise facilitate processingof messages and responses related to OTA, including messaging with aservice provisioning system via one or more OTA servers.

It will be appreciated that the communication device 102 may be anydevice, including a user device, which has a secure element and a securedevice processor. The term “user,” in this example, refers to a humanuser of the communication device. However, in other embodiments, theuser can be a machine that exchanges data with the communication device102 after being authenticated to the communication device. Communicationdevice 102 can include a device processor 104, the SDP 106 and thesecure element 108 (e.g., which can include a UICC). The secure element108 can be various types of smart cards including a SubscriberIdentification Module (SIM) card or other types of secure element. Thesecure element 108 can be a secure computing platform and can offer ahigh level of security for storing encryption keys, authenticationcredentials, and the like. The secure element 108 may be removable fromthe device. In other embodiments, the secure element 108 may be embeddedin the device and not removable. In other embodiments, the secureelement 108 can be placed on a memory card or an embedded chip.

The SDP 106 can be logically and/or physically separate from the deviceprocessor 104, and can be connected to both the device processor and thesecure element 108. In this embodiment, the SDP 106 can offer a higherlevel of security than the device processor 104, and can store andexecute secure applications. The SDP 106 can, for example, runapplications in a trusted execution environment. The secure element 108and SDP 106 together can form a secure services platform 110 resident onthe device 102. In this embodiment, secure element 108, SDP 106 anddevice processor 104 can each have a security level associatedtherewith, and the security level associated with the SDP 106 can beintermediate between that of the secure element 108 and that of thedevice processor 104. The SDP 106 and secure element 108 can use mutualauthentication, as described in more detail below.

The secure element 108 and SDP 106 can communicate with a remotemanagement (function) server 120, located remotely from device 102. TheRemote Management Server (RMS) 120 can be a platform for provisioningand/or managing applications in the secure element 108 and SDP 106. TheRMS 120 can also manage data (such as keys, credentials, and so forth)that are used by the applications. Examples of remote management serversare described in U.S. patent application Ser. No. 13/679,479 filed onNov. 16, 2012 and U.S. patent application Ser. No. 13/680,680 filed onNov. 19, 2012, the disclosures of both of which are hereby incorporatedby reference.

In this embodiment, user device 102 can be a wireless communicationdevice connected to a cellular network 122. Network 122 can also beother types of networks operating according to various communicationprotocols, such as a WiFi network. In other embodiments, device 102 canbe connected to other devices via a wired connection through a computer.In still other embodiments, user devices can communicate with each otherusing Bluetooth, infrared communications (IRDa) and/or near fieldcommunications (NFC). A communication session between user devices,wherein information is transferred between the users, can be effected bya wide variety of arrangements. A secure application server (SAS) can beused in some embodiments to establish a secure communication sessionbetween devices. However, in some embodiments a secure applicationserver may not be used where the communication session is established ina peer-to-peer manner, such as in Bluetooth, IRDa or NFC.

System 100 enables components of the secure services platform 110 (e.g.,an administrative agent function of the SDP 106) to perform operationsincluding one or more of registering an Internet Protocol (IP) addresswith the OTA server 150 where the IP address is associated with theadministrative agent function; receiving, from the OTA server, an OTAmessage that includes programming data for use by the mobilecommunication device where the OTA message is encrypted by the OTAserver and where the OTA message utilizes a hypertext transfer protocol;decrypting the OTA message utilizing a first keyset (e.g., a transportkeyset) to generate a decrypted OTA message; determining a schedule forproviding messages to a secure element of the mobile communicationdevice where the SDP is separate from the secure element and incommunication with the secure element; and providing the decrypted OTAmessage to the secure element according to the schedule.

System 100 enables components of the secure services platform 110 (e.g.,the secure element 108) to perform operations including one or more ofreceiving a request for a first keyset (e.g., a transport keyset) wherethe request is received from an SDP of the mobile communication deviceand where the secure element is separate from the SDP and incommunication with the SDP; providing the first keyset to the SDP toenable the SDP to decrypt an OTA message to generate a decrypted OTAmessage where the OTA message includes programming data for provisioningthe mobile communication device; receiving the decrypted OTA message;and performing an additional decryption of the decrypted OTA messageutilizing a second keyset where the SDP does not have access to thesecond keyset. In one embodiment, the secure element can receive astatic key from the remote management server 120, where the remotemanagement server provides the static key to the OTA 150 server thattransmitted the OTA message to the SDP; and can generate the firstkeyset from the static key. In one embodiment, the secure element caninclude a UICC, wherein the OTA message utilizes HTIP, and where thereceiving of the decrypted OTA message is according to a schedulegenerated by the SDP. In one embodiment, the secure element can generatea response to the OTA message; can encrypt the response utilizing thesecond keyset (e.g., application keyset) to generate an encryptedresponse; and can provide the encrypted response to the SDP fortransmission to a service provisioning system 175 that originated theOTA message to enable the service provisioning system to decrypt theencrypted response utilizing the second keyset.

In one embodiment, the OTA server 150 can receive a registration requestincluding an internet protocol address, where the registration requestis received from SDP 106 of a mobile communication device. The OTAserver 150 can encrypt an OTA message utilizing a first keyset togenerate an encrypted OTA message, where the OTA message includesprogramming data for use by the mobile communication device. The OTAserver 150 can provide the encrypted OTA message to the SDP 106 toenable the SDP to decrypt the encrypted OTA message utilizing the firstkeyset, where the providing of the encrypted OTA message further enablesthe SDP to provide the programming data to a secure element (e.g., UICC108) of the mobile communication device for provisioning of the mobilecommunication device, and where the SDP is separate from the secureelement and in communication with the secure element. In one embodiment,the OTA server 150 can receive the OTA message from the serviceprovisioning system 175, where the OTA message is encrypted by theservice provisioning system 175 utilizing a second keyset (e.g.,application keyset), where the second keyset is accessible to the secureelement and the service provisioning system, and where the second keysetis not accessible to the server and the secure device processor. In oneembodiment, the providing of the encrypted OTA message to the SDPutilizes HTTP. In one embodiment, the OTA server 150 can receive astatic key from the remote management server 120, where the remotemanagement server provides the static key to the secure element toenable the secure element to generate, or otherwise derive, a key of thefirst keyset from the static key and to enable the secure element toprovide the first keyset to the SDP. In one embodiment, the OTA servercan generate another key of the first keyset from the static key. In oneembodiment, the first keyset can be provided to the OTA server 150 andto the mobile communication device by the remote management server 120.In one embodiment, the OTA server 150 can receive the OTA message fromthe service provisioning system 175; can receive a request from theservice provisioning system to provide the OTA message to another mobilecommunication device; can determine that another secure device processorof the other mobile communication device is not registered with the OTAserver; and can provide a notice to the service provisioning systemindicating that the other secure device processor is not registered withthe server. In one embodiment, the OTA server 150 can receive a responseto the OTA message; can decrypt the response utilizing the first keysetto generate a decrypted response; and can provide the decrypted responseto the service provisioning system 175 that originated the OTA message.In one embodiment, the OTA server 150 can store the message fortransmission later. In another embodiment, the OTA server 150 canretransmit the message, if necessary.

FIG. 2 is a schematic illustration 200 showing details of a secureservices platform 110, according to an embodiment of the disclosure,which can be used with the communication device 102 of FIG. 1. Thesecure element 108 can contain an authentication management function 202and a real-time encryption key generator 204. The authenticationmanagement function 202 can provide authentication services for thedevice. For example, the authentication management function 202 cansupport mutual authentication of devices, support a mutualauthentication of the device, such as with the RMS 120 of FIG. 1. Asshown in FIG. 2, the authentication management function 202 can includea user authentication service 212 for authenticating the user to thedevice and a network authentication service 214 for authenticating thedevice to network equipment. The real-time encryption key generator 204can supply encryption keys to a real-time encryption engine 206 which islocated in the SDP 106. The real-time encryption engine 206 can encryptand decrypt user information transmitted to or from a bearer path 216that terminates at another device (e.g., another user device), and mayencrypt and decrypt information transmitted on a signaling path 218 tothe network. In another embodiment, the encryption engine can be loadedon a second secure element, separate from the secure element 108.

The RMS 120 can perform a remote provisioning and management function210 to load applications, content and/or other information (e.g.,various keysets) into the secure element 108 and/or SDP 106. In thisembodiment, the RMS 120 can provision the authentication managementfunction 202 and real-time encryption key generator 204 on the secureelement 108, and can provision the real-time encryption engine 206 onthe SDP 106. This can be done securely by the use of one or more remotemanagement keysets. In one embodiment, before the secure servicesplatform 110 can be used for communication, the SDP 106 can beauthenticated by the secure element 108. In one embodiment, this can bedone using a UICC-SDP keyset. The UICC-SDP keyset may be provisionedremotely by the RMS 120 or locally by an authorized user. In thisembodiment, after the secure element 108 and SDP 106 are mutuallyauthenticated using the UICC-SDP keyset, they can communicate via asignaling path 208 within the secure services platform 110. The UICC-SDPkeyset may be used for secure communication during initial loading andprovisioning. However, the keys being utilized may be different. In oneembodiment, the path between the secure element 108 and the SDP 106 cango through the device processor 104 rather than directly between thesecure element and the SDP.

In this embodiment of FIG. 2, the secure services platform 110 enablesprocessing messages and responses related to OTA. These messages can beauthenticated and/or encrypted utilizing various keysets that areexclusive to various devices or components so that the end points of thecommunication (e.g., the secure element and the service provisioningsystem) securely receive the programming data and/or the responserelated to the programming data. Various keysets can be distributedbetween pairs of devices or components, such as providing an SDP keysetto both of the administrative agent key function (of the secure element108) and the administrative agent function (of the SDP 106), providing atransport keyset to both of the OTA server and the administrative agentfunction, and/or providing an application keyset to both the serviceprovisioning system and the secure element. In one embodiment, theprovisioning of one or more of these keysets can be performed by theremote management server, such as through use of remote managementkeysets.

Referring to FIGS. 3A-B, a system 300 is depicted which illustrates asecure process for providing messages and responses related to OTA.System 300 can include managing HTTP-based OTA traffic from multiplesources to the secure element (e.g., UICC). In one embodiment,HTTP-based OTA messages can be sent from a service provisioning systemto the secure element via a network-based OTA server and a device-basedadministrative agent function (e.g., operating in the secure deviceprocessor). The OTA server can prepare the message for OTA transport andmay provide additional security, such as in the form of authenticationand/or encryption. The administrative agent function, which can belocated in or otherwise operated by the SDP, can receive HTIP-based OTAmessages from one or more OTA servers, and can manage the delivery ofthe messages to the secure element, such as the UICC. The administrativeagent function can also support additional security measures that wereperformed by the OTA server.

In one embodiment, the OTA server can perform transmitting and receivingmessages to/from one or more service provisioning systems; transmittingand receiving messages to/from the UICC via the administrative agentfunction; and/or authenticating the administrative agent function andencrypting the OTA message.

In one embodiment, the SDP can contain or otherwise execute theadministrative agent function. The SDP can be a processor that islogically and/or physically separate from the device processor and/orthe secure element, and can offer more hardened security than the deviceprocessor, but not as much security as the UICC. The administrativeagent function can perform one or more of transmitting and receivingmessages to/from one or more OTA servers; providing transport securitybetween itself and an OTA server; encrypting and decrypting messagesusing one or more transport keys; transmitting and receiving messagesto/from the secure element; and managing the communication path to thesecure element such as message queuing, scheduling (e.g., schedulingpackets for transmission), response correlation (e.g., tracking andcorrelating responses for each transmission) and/or reliable deliveryvia retransmission. The SDP can also register an IP address (e.g., theIP address associated with the administrative agent function) with theOTA server.

In one embodiment, the secure element (e.g., the UICC) may contain orotherwise execute an administrative agent key function that can providetransport key(s), which are derived from a static key(s), to theadministrative agent function. The secure element can perform securityoperations that were initiated by the service provisioning system, suchas decryption based on application keysets. In one embodiment, multipleOTA servers can communicate with a single administrative agent function.In one embodiment, the transport key can be preloaded into the UICC(and/or the OTA server) or the transport key can be generated, orotherwise derived, from a static key (which in some embodiments can bederived from a master key).

In one embodiment, the remote management server can manage theapplications on both the secure element and the SDP. For example, theremote management server can manage the download of static keys (forderiving the transport keys) and/or transport keys, as well as thestatus of existing transport keys. These transport keys may exist ineither or both of the administrative agent key function and theadministrative agent function. The remote management server can alsoprovide a static key (for generating a transport key) and/or transportkeys to other devices, such as the OTA server. These operations can bedone securely by the use of one or more remote management keysets. Thesekeysets can be used to mutually authenticate the secure element and SDPwith the remote management server and/or to enable encryption betweenthem. In one embodiment, the remote management server may use existingShort Message Service (SMS)-based OTA messaging to manage the secureelement, including the administrative agent key function.

In one embodiment, the remote management server can be the source of thestatic key and/or may store the static key. In one embodiment, theremote management server can provide the static key to the secureelement and to the OTA server. In one embodiment, the secure element andthe OTA server can use the static key to generate or otherwise derivethe transport key.

In another embodiment, the remote management server can provide a statickeyset to the secure element and the OTA server. In one embodiment, thestatic keyset can be a master key or can be a static key that is derivedfrom the master key. In one example, both the secure element and the OTAserver can use the static key to derive the transport keys of thetransport keyset. In one embodiment, the remote management server maystore the static keyset. In another embodiment, a static key (e.g.,derived from a master key by the remote management server) may be sentto the UICC and the OTA server, such as by the remote management server.The static key can be used to derive dynamic transport keys. In oneembodiment, the UICC and the OTA server can be provided with the firstkeyset (e.g., transport keys), such as by the remote management server.

Referring to FIGS. 4A-B, system 400 is depicted which illustratesloading or otherwise provisioning the end user device(s) with theapplications that are utilized by the secure services platform forperforming the secure OTA messaging process. In one embodiment, therecan be a plurality of applications to be loaded or otherwiseprovisioned, such as the administrative agent function and theadministrative agent key function. For example, if the applications havenot been loaded at the factory, then at 1 a the remote management servercan download the administrative agent function to the SDP and theadministrative agent key function to the secure element. In oneembodiment, remote management keysets can be used to securely transmitinformation from the remote management server to the UE(s). This processcan utilize mutual authentication and/or encryption. In one embodiment,the remote management server may use SMS-based OTA to manage the secureelement, including the download of the administrative agent keyfunction.

At 1 b, the administrative agent function and the administrative agentkey function can mutually authenticate with each other, such as throughutilizing an SDP keyset. The administrative agent function can verifythat it is able to communicate with the administrative agent keyfunction. At 1 c, the remote management server can download one or moretransport keys to the administrative agent key function and/or directlyto the administrative agent function. This can be performed using aremote management keyset. As described above, the remote managementserver may use SMS-based OTA to manage the secure element, which mayinclude the loading of the transport keys. In one embodiment, the remotemanagement server may download the static key (which can be a master keyor can be derived from a master key), or one or more transport keys tothe administrative agent key function and/or directly to theadministrative agent function. The static key can be used for deriving,by the remote management server, a key of the transport keys. At 1 d,the remote management server can provide the transport key to one ormore OTA servers. In one embodiment, the remote management server maydownload a static key (which can be a master key), or one or moretransport keys to the OTA server. The static key can be used forderiving, by the OTA server, a key of the transport keys. At 1 e, theadministrative agent function can register its IP address with one ormore OTA servers. This process can include mutual authentication and/orencryption using the transport keys.

Referring to FIGS. 5A-B, system 500 is depicted which illustrates aprocess for securely communicating messages and responses related toOTA. The process is based on the OTA server forwarding an OTA messagefrom a service provisioning system to the administrative agent functionfor transmission to the secure element. At 2 a, a service provisioningsystem can prepare a message to be sent to the secure element. Thismessage can be HTIP-based and may be encrypted using an applicationkeyset. At 2 b, the OTA server can receive the OTA message and canprepare to transmit the OTA message to the administrative agent functionvia HTTP. The OTA server may use a suitable transport key toauthenticate the administrative agent function and encrypt the message.In one embodiment, if the administrative agent function has notregistered with the OTA server, the OTA server can provide a suitableresponse back to the service provisioning system. In one embodiment, ifthe administrative agent function is not registered with the OTA serverthen the OTA server can store the OTA message for transmission at alater time, such as when the administrative agent function becomesregistered. In one embodiment, periodic monitoring for registration canbe performed.

At 2 c, the administrative agent function can receive the message andcan check to see if it is encrypted and authenticated with a transportkey. If not, the administrative agent function can act upon the messageas described in Step 2 f. If so, the administrative agent function candetermine whether or not it has the proper key to decrypt the messageand can authenticate the OTA server. If it does then it can decrypt themessage using its own transport key, can authenticate the OTA server,and can act upon the message as described in Step 2 f.

At 2 d, if the message is encrypted with a transport key and theadministrative agent function does not have a corresponding transportkey to decrypt it, the administrative agent function can ask theadministrative agent key function to provide one. To do this, theadministrative agent function can generate a request and can transmitthe request to the administrative agent key function which can respondwith a suitable transport key. In one embodiment, the key provided bythe administrative agent key function can be derived from a static keystored by or otherwise accessible to the administrative agent keyfunction. At 2 e, the administrative agent function can decrypt themessage using either its own transport key or one provided by theadministrative agent key function. The administrative agent function canthen authenticate the OTA server. At 2 f, the administrative agentfunction can schedule the message for transmission to a UICC terminatingentity (such as through generating a messaging schedule). Once themessage is ready for transmission, the administrative agent function canschedule it for transmission, can transmit it at the scheduled time, cantrack the response from the secure element, and can retransmit ifnecessary.

At 2 g, the UICC terminating entity can receive the message and canperform actions based on the content of the message, such as softwareupdate configuration setting adjustments, and so forth. If the messageis encrypted with an application key, the UICC terminating entity candecrypt the message using its own application key. The UICC terminatingentity may also respond to the message. At 2 i, if a response isprovided, then the response will travel back to the administrative agentfunction. The administrative agent function can correlate or otherwisemap the response to the initial OTA message, encrypt the response with atransport key if desired, and transmit the response to the OTA server.At 2 j, the OTA server can receive the response to the initial OTAmessage. In one embodiment, the OTA server can perform decryptionutilizing the first keyset (e.g., a transport key). At 2 k, the OTAserver can transmit the response back to the service provisioningsystem. In one embodiment, the service provisioning system can performdecryption utilizing another keyset (e.g., an application key).

FIG. 6 depicts an illustrative embodiment of a method for providingsecure over-the-air programming of a communication device. All or aportion of the steps of method 600 can be performed by various devices,including end user devices such as device 102 including secure servicesplatform 110. More or less than the steps described in method 600 can beperformed in one or more exemplary embodiments, and the order of stepscan be rearranged. Method 600 can begin at 602 where a registrationbetween a secure device processor (e.g., an administrative agentfunction) of a mobile communication device and an OTA server occurs. Theregistration can include the administrative agent function providing aninternet protocol address to the OTA server, wherein the internetprotocol address is associated with the administrative agent function.At 604, the administrative agent function can receive, from the OTAserver, an OTA message. The OTA message can include programming data foruse by the mobile communication device (e.g., usable by the secureelement). In one embodiment, the OTA message can be encrypted by the OTAserver. In another embodiment, the OTA message can utilize HTTP,although other transport protocols can also be used, such as SMS-basedmessaging. The programming data of the OTA message can be of varioustypes including software updates, configuration settings, and/or otherinformation that is utilized by the mobile communication device. Theprogramming data can be over-the-air service provisioning (OTASP),over-the-air provisioning (OTAP) and/or over-the-air parameteradministration (OTAPA).

At 606, the administrative agent function can detect an encryption ofthe OTA message and can decrypt it utilizing a first keyset (e.g., atransport keyset) to generate a decrypted OTA message. In one embodimentat 608, the administrative agent function can determine whether it haspossession of the first keyset (e.g., stored in a memory of the securedevice processor) and, if not, the administrative agent function canprovide a keyset request to the secure element. In response to therequest, the secure element (e.g., an administrative agent key functionoperating in a UICC) can provide the requested keyset (e.g., thetransport keyset) to the administrative agent function. In oneembodiment, the communication between the administrative agent functionof the secure device processor and the administrative agent key functionof the secure element can be based on a mutual authentication thatutilizes SDP keyset provided to both the secure element and the securedevice processor by the remote management server utilizing remotemanagement keyset.

At 610, the administrative agent function can determine or otherwisegenerate a schedule for providing messages to the secure element of themobile communication device. In this embodiment, the secure deviceprocessor is separate from the secure element and in communication withthe secure element, as described in FIGS. 1 and 2. At 612, theadministrative agent function can provide the decrypted OTA message tothe secure element according to the schedule to enable the secureelement (e.g., a UICC terminating entity operating in the secureelement) to utilize the programming data of the OTA message, such as forprovisioning of the mobile communication device (e.g., software updates,configuration setting adjustments, and so forth).

In one embodiment, the secure element can comprise a UICC. In oneembodiment, the method 600 can further include one or more ofmonitoring, by the administrative agent function, for a responseprovided by the secure element; determining, by the administrative agentfunction, that the response is associated with the OTA message;encrypting, by the administrative agent function, the response utilizingthe first keyset to generate an encrypted response; and providing, bythe administrative agent function, the encrypted response to the OTAserver to enable the OTA server to decrypt the encrypted response fortransmission, such as to a service provisioning system that originatedor is otherwise associated with the OTA message. In one embodiment, theproviding of the decrypted OTA message to the secure element enables thesecure element to further decrypt the decrypted OTA message utilizing asecond keyset (e.g., an application keyset). In one embodiment, theapplication keyset can be stored by or otherwise accessible to thesecure element and the service provisioning system. In anotherembodiment, the application keyset may not be accessible to the securedevice processor. In another embodiment, the application keyset may notbe accessible to the OTA server.

In one embodiment, method 600 can include authenticating, by theadministrative agent function, with the secure element utilizing a thirdkeyset (e.g., an SDP keyset). In one embodiment, the first keyset can begenerated or otherwise derived by the secure element (e.g., theadministrative agent key function) from a static key that is provided bya remote management server to the secure element and to the OTA server.In another embodiment, the providing of the static key to the secureelement by the remote management server can be based on another OTAmessage that utilizes SMS transport protocol (e.g., SMPP). In oneembodiment the static key can be a master key or can be derived from amaster key.

In one embodiment, method 600 can include receiving, by theadministrative agent function, the first keyset (e.g., transport keyset)from a remote management server, where the remote management serverprovides the first keyset to the OTA server, and where the receiving ofthe first keyset by the administrative agent function is performedutilizing a remote management keyset.

In one embodiment, the administrative agent function can be downloadedto the secure device processor utilizing the remote management keyset.In one embodiment, the administrative agent key function can bedownloaded to the secure element utilizing the remote management keyset.

In one embodiment, the OTA message can originate from a serviceprovisioning system, where the providing of the decrypted OTA message tothe secure element enables the secure element to further decrypt thedecrypted OTA message utilizing a second keyset (e.g., applicationkeyset), where the administrative agent function and the OTA server donot have access to the second keyset, and wherein the serviceprovisioning system has access to the second keyset.

In one embodiment, the method 600 can include one or more ofdetermining, by the administrative agent function, that a response hasbeen generated by the secure element and is associated with the OTAmessage; and providing, by the administrative agent function, theresponse to the OTA server for transmission to the service provisioningsystem. In one embodiment, the response can be encrypted by the secureelement utilizing the second keyset (e.g., application keyset), wherethe response is configured for decryption by the service provisioningsystem utilizing the second keyset.

In one embodiment, method 600 can include providing, by theadministrative agent function, a request to the secure element for thefirst keyset responsive to a determination that the OTA message has beenencrypted; and receiving, by the administrative agent function, thefirst keyset from the secure element. In another embodiment, the statickey can be provided to the secure element (e.g., the administrativeagent key function) and the OTA server for deriving of the transportkeys, respectively, of the transport keyset. In one embodiment, method600 can include retransmitting, by the administrative agent function,the decrypted OTA message to the secure element.

FIG. 7 depicts an illustrative embodiment of a communication system 700for delivering media content. The communication system 700 can representan Internet Protocol Television (IPTV) media system. Communicationsystem 700 can be overlaid or operably coupled with systems 100, 200 ofFIGS. 1 and 2 as another representative embodiment of communicationsystem 700. In one or more embodiments, system 700 enables utilizingboth the secure element and SDP together to provide a secure platformfor delivering messages and responses related to OTA. System 700 canenable registering an IP address with an OTA server; receiving, from theOTA server, an OTA message that includes programming data for use by themobile communication device, where the OTA message is encrypted by theOTA server and utilizes HTTP; decrypting the OTA message utilizing afirst keyset to generate a decrypted OTA message; determining a schedulefor providing messages to a secure element of the mobile communicationdevice; and providing the decrypted OTA message to the secure elementaccording to the schedule.

In one or more embodiments, system 700 enables authentication and/orencryption to be performed between various devices (or components of asingle device) based on keysets distributed between pairs of devices orcomponents, such as providing an SDP keyset to both of the secureelement and the SDP, providing a transport keyset to both of the SDP andthe OTA server, and/or providing an application keyset to both thesecure element and the service provisioning system. The distribution ofthese keysets can be exclusive between the pairs of devices orcomponents or can be non-exclusive.

The IPTV media system can include a super head-end office (SHO) 710 withat least one super headend office server (SHS) 711 which receives mediacontent from satellite and/or terrestrial communication systems. In thepresent context, media content can represent, for example, audiocontent, moving image content such as 2D or 3D videos, video games,virtual reality content, still image content, and combinations thereof.The SHS server 711 can forward packets associated with the media contentto one or more video head-end servers (VHS) 714 via a network of videohead-end offices (VHO) 712 according to a multicast communicationprotocol.

The VHS 714 can distribute multimedia broadcast content via an accessnetwork 718 to commercial and/or residential buildings 702 housing agateway 704 (such as a residential or commercial gateway). The accessnetwork 718 can represent a group of digital subscriber line accessmultiplexers (DSLAMs) located in a central office or a service areainterface that provide broadband services over fiber optical links orcopper twisted pairs 719 to buildings 702. The gateway 704 can usecommunication technology to distribute broadcast signals to mediaprocessors 706 such as Set-Top Boxes (STBs) which in turn presentbroadcast channels to media devices 708 such as computers or televisionsets managed in some instances by a media controller 707 (such as aninfrared or RF remote controller).

The gateway 704, the media processors 706, and media devices 708 canutilize tethered communication technologies (such as coaxial, powerlineor phone line wiring) or can operate over a wireless access protocolsuch as Wireless Fidelity (WiFi), Bluetooth, Zigbee, or other present ornext generation local or personal area wireless network technologies. Byway of these interfaces, unicast communications can also be invokedbetween the media processors 706 and subsystems of the IPTV media systemfor services such as video-on-demand (VoD), browsing an electronicprogramming guide (EPG), or other infrastructure services.

A satellite broadcast television system 729 can be used in the mediasystem of FIG. 7. The satellite broadcast television system can beoverlaid, operably coupled with, or replace the IPTV system as anotherrepresentative embodiment of communication system 700. In thisembodiment, signals transmitted by a satellite 715 that include mediacontent can be received by a satellite dish receiver 731 coupled to thebuilding 702. Modulated signals received by the satellite dish receiver731 can be transferred to the media processors 706 for demodulating,decoding, encoding, and/or distributing broadcast channels to the mediadevices 708. The media processors 706 can be equipped with a broadbandport to an Internet Service Provider (ISP) network 732 to enableinteractive services such as VoD and EPG as described above.

In yet another embodiment, an analog or digital cable broadcastdistribution system such as cable TV system 733 can be overlaid,operably coupled with, or replace the IPTV system and/or the satelliteTV system as another representative embodiment of communication system700. In this embodiment, the cable TV system 733 can also provideInternet, telephony, and interactive media services.

The subject disclosure can apply to other present or next generationover-the-air and/or landline media content services system.

Some of the network elements of the IPTV media system can be coupled toone or more computing devices 730, a portion of which can operate as aweb server for providing web portal services over the ISP network 732 towireline media devices 708 or wireless communication devices 716.

Communication system 700 can also provide for computing devices 730 tofunction as a remote management server, an OTA server and/or a serviceprovisioning system (herein referred to as server 730). The server 730can use computing and communication technology to perform function 762,which can include among other things, provisioning various devices orcomponents, such as through use of remote management keysets. Theprovisioning can be of applications, such as the administrative agentfunction and/or the administrative agent key function, and/or can be ofkeysets, such as transport keysets. Function 762 can include one or moreof receiving a registration request including an IP address, where theregistration request is received from a secure device processor of amobile communication device; encrypting an OTA message utilizing a firstkeyset to generate an encrypted OTA message, where the OTA messageincludes programming data for use by the mobile communication device;and providing the encrypted OTA message to the secure device processorto enable the secure device processor to decrypt the encrypted OTAmessage utilizing the first keyset. In one embodiment, the providing ofthe encrypted OTA message can further enable the secure device processorto provide the programming data to a secure element of the mobilecommunication device for provisioning of the mobile communicationdevice. In another embodiment, the secure device processor can beseparate from the secure element and in communication with the secureelement.

Function 766 can include functions being performed at the secure element108 including one or more of receiving a request for a first keyset,where the request is received from a secure device processor of themobile communication device, and where the secure element is separatefrom the secure device processor and in communication with the securedevice processor; providing the first keyset to the secure deviceprocessor to enable the secure device processor to decrypt an OTAmessage to generate a decrypted OTA message where the OTA messageincludes programming data for provisioning the mobile communicationdevice; receiving, from the secure device processor, the decrypted OTAmessage; and performing an additional decryption of the decrypted OTAmessage utilizing a second keyset. In one embodiment, the secure deviceprocessor does not have access to the second keyset.

Function 766 can also include functions being performed at the SDP 106such as one or more of registering an IP address with an OTA server,where the IP address is associated with the administrative agentfunction; receiving, from the OTA server, an OTA message that includesprogramming data for use by the mobile communication device, where theOTA message is encrypted by the OTA server, where the OTA messageutilizes HTTP; decrypting the OTA message utilizing a first keyset(e.g., transport keyset) to generate a decrypted OTA message;determining a schedule for providing messages to a secure element of themobile communication device where the secure device processor isseparate from the secure element and in communication with the secureelement; and providing the decrypted OTA message to the secure elementaccording to the schedule.

Multiple forms of media services can be offered to media devices overlandline technologies such as those described above. Additionally, mediaservices can be offered to media devices by way of a wireless accessbase station 717 operating according to common wireless access protocolssuch as Global System for Mobile or GSM, Code Division Multiple Accessor CDMA, Time Division Multiple Access or TDMA, Universal MobileTelecommunications or UMTS, World interoperability for Microwave orWiMAX, Software Defined Radio or SDR, Long Term Evolution or LTE, and soon. Other present and next generation wide area wireless access networktechnologies can be used in one or more embodiments of the subjectdisclosure.

FIG. 8 depicts an illustrative embodiment of a communication device 800.Communication device 800 can serve in whole or in part as anillustrative embodiment of the devices depicted in FIGS. 1-5 and 7. Forinstance, device 800 can include a secure element (e.g., executing anadministrative agent key function) and a secure device processor(executing an administrative agent function) in the secure servicesplatform 110 which perform the functions described in the exemplaryembodiments herein.

In one or more embodiments, the secure element of device 800 can performoperations including generating transport keys from a static key andproviding the transport key to the SDP so that the SDP can authenticate,encrypt and/or decrypt in conjunction to messages/responses of the OTAserver. The secure element can also decrypt OTA messages originated fromthe service provisioning system; generate and encrypt responses to theOTA message that are to be transmitted (by the SDP) to the serviceprovisioning system; and/or utilize programming data included in the OTAmessage (e.g., updating software, adjusting device settings, and soforth). In other embodiments, static keys can be selectively distributedto enable deriving the transport keyset.

In one or more embodiments, the SDP (e.g., the administrative agentfunction) of device 800 can perform operations including authenticate,encrypt and/or decrypt in conjunction to messages/responses of the OTAserver, request transport keys from the secure element; scheduletransmissions of OTA messages to the secure element; and/or retransmitOTA messages to the secure element.

To enable these features, communication device 800 can comprise awireline and/or wireless transceiver 802 (herein transceiver 802), auser interface (UI) 804, a power supply 814, a location receiver 816, amotion sensor 818, an orientation sensor 820, and a controller 806 formanaging operations thereof. The transceiver 802 can support short-rangeor long-range wireless access technologies such as Bluetooth, ZigBee,WiFi, DECT, or cellular communication technologies, just to mention afew. Cellular technologies can include, for example, CDMA-1X,UMTS/HSDPA, GSM/GPRS, TDMA/EDGE, EV/DO, WiMAX, SDR, LTE, NFC, as well asother next generation wireless communication technologies as they arise.The transceiver 802 can also be adapted to support circuit-switchedwireline access technologies (such as PSTN), packet-switched wirelineaccess technologies (such as TCP/IP, VoIP, etc.), and combinationsthereof.

The UI 804 can include a depressible or touch-sensitive keypad 808 witha navigation mechanism such as a roller ball, a joystick, a mouse, or anavigation disk for manipulating operations of the communication device800. The keypad 808 can be an integral part of a housing assembly of thecommunication device 800 or an independent device operably coupledthereto by a tethered wireline interface (such as a USB cable) or awireless interface supporting for example Bluetooth. The keypad 808 canrepresent a numeric keypad commonly used by phones, and/or a QWERTYkeypad with alphanumeric keys. The UI 804 can further include a display810 such as monochrome or color LCD (Liquid Crystal Display), OLED(Organic Light Emitting Diode) or other suitable display technology forconveying images to an end user of the communication device 800. In anembodiment where the display 810 is touch-sensitive, a portion or all ofthe keypad 808 can be presented by way of the display 810 withnavigation features.

The display 810 can use touch screen technology to also serve as a userinterface for detecting user input. As a touch screen display, thecommunication device 800 can be adapted to present a user interface withgraphical user interface (GUI) elements that can be selected by a userwith a touch of a finger. The touch screen display 810 can be equippedwith capacitive, resistive or other forms of sensing technology todetect how much surface area of a user's finger has been placed on aportion of the touch screen display. This sensing information can beused to control the manipulation of the GUI elements or other functionsof the user interface. The display 810 can be an integral part of thehousing assembly of the communication device 800 or an independentdevice communicatively coupled thereto by a tethered wireline interface(such as a cable) or a wireless interface.

The UI 804 can also include an audio system 812 that utilizes audiotechnology for conveying low volume audio (such as audio heard inproximity of a human ear) and high volume audio (such as speakerphonefor hands free operation). The audio system 812 can further include amicrophone for receiving audible signals of an end user. The audiosystem 812 can also be used for voice recognition applications. The UI804 can further include an image sensor 813 such as a charged coupleddevice (CCD) camera for capturing still or moving images.

The power supply 814 can utilize common power management technologiessuch as replaceable and rechargeable batteries, supply regulationtechnologies, and/or charging system technologies for supplying energyto the components of the communication device 800 to facilitatelong-range or short-range portable applications. Alternatively, or incombination, the charging system can utilize external power sources suchas DC power supplied over a physical interface such as a USB port orother suitable tethering technologies.

The location receiver 816 can utilize location technology such as aglobal positioning system (GPS) receiver capable of assisted GPS foridentifying a location of the communication device 800 based on signalsgenerated by a constellation of GPS satellites, which can be used forfacilitating location services such as navigation. The motion sensor 818can utilize motion sensing technology such as an accelerometer, agyroscope, or other suitable motion sensing technology to detect motionof the communication device 800 in three-dimensional space. Theorientation sensor 820 can utilize orientation sensing technology suchas a magnetometer to detect the orientation of the communication device800 (north, south, west, and east, as well as combined orientations indegrees, minutes, or other suitable orientation metrics).

The communication device 800 can use the transceiver 802 to alsodetermine a proximity to a cellular, WiFi, Bluetooth, or other wirelessaccess points by sensing techniques such as utilizing a received signalstrength indicator (RSSI) and/or signal time of arrival (TOA) or time offlight (TOF) measurements. The controller 806 can utilize computingtechnologies such as a microprocessor, a digital signal processor (DSP),programmable gate arrays, application specific integrated circuits,and/or a video processor with associated storage memory such as Flash,ROM, RAM, SRAM, DRAM or other storage technologies for executingcomputer instructions, controlling, and processing data supplied by theaforementioned components of the communication device 800.

Other components not shown in FIG. 8 can be used in one or moreembodiments of the subject disclosure. For instance, the communicationdevice 800 can include a reset button (not shown). The reset button canbe used to reset the controller 806 of the communication device 800. Inyet another embodiment, the communication device 800 can also include afactory default setting button positioned, for example, below a smallhole in a housing assembly of the communication device 800 to force thecommunication device 800 to re-establish factory settings. In thisembodiment, a user can use a protruding object such as a pen or paperclip tip to reach into the hole and depress the default setting button.In one embodiment, the communication device 800 can also include a slotfor adding or removing the UICC.

The communication device 800 as described herein can operate with moreor less of the circuit components shown in FIG. 8. These variantembodiments can be used in one or more embodiments of the subjectdisclosure.

The communication device 800 can be adapted to perform the functions ofthe media processor 706, the media devices 708, the portablecommunication devices 716 and/or the server 730 of FIG. 7. It will beappreciated that the communication device 800 can also represent otherdevices that can operate in communication system 700 of FIG. 7, such asa gaming console and a media player.

The communication device 800 shown in FIG. 8 or portions thereof canserve as a representation of one or more of the devices of FIGS. 1-5 and7 including end user devices, customer premises equipment, remotemanagement servers, OTA servers and/or service provisioning system. Inone or more embodiments, the OTA server 150 and/or the serviceprovisioning system can be operated by, or otherwise affiliated with, athird party entity that is different from and/or independent of theservice provider operating the RMS 120. In addition, the controller 806can perform the functions 762 and/or 766.

Upon reviewing the aforementioned embodiments, it would be evident to anartisan with ordinary skill in the art that said embodiments can bemodified, reduced, or enhanced without departing from the scope of theclaims described below. For example, in the event that a secure elementand/or SDP is determined to be inaccessible (such as via an HTTPmessage) from the OTA server, an alert can be generated to implementtechniques for delivering of the OTA message as described in the U.S.Patent Application entitled “Apparatus and Method for Secure Over TheAir Programming of a Communication Device” with Docket No.2013-1003_7785-1043, application Ser. No. 14/069,908, issued as U.S.Pat. No. 9,240,989, the disclosure of which is hereby incorporated byreference. For instance, the alert can be transmitted to the mobiledevice to indicate that OTA programming data is available. In anotherembodiment, the alert can cause a network interworking function oranother network element to determine if there are other alternatedelivery techniques available for the secure element.

In one embodiment, encryption can be applied by the service provisioningsystem to the OTA message or by the secure element to the response basedon various encryption techniques including elliptical curvecryptography, Advance Encryption Standard (AES), and so forth. Otherencryption techniques can be utilized, including symmetrical and/orasymmetrical cryptographic methods. In another embodiment, the mobilecommunication device can communicate with the service provisioningsystem (or another device) via the administrative agent function totransfer various information (e.g., in a secure message), which may ormay not be related to the OTA message. This information can be providedwith the various security procedures described above with respect to oneor more of the exemplary embodiments, including encrypting withapplication keyset (e.g., done at the secure element), encrypting withtransport keyset (e.g., done at an application agent function of themobile communication device), and/or authentication between variousdevices and/or components (e.g., authentication between the secureelement and the administrative agent function, authentication betweenthe OTA server and the administrative agent function, and so forth).

As an example, the secure element can generate a secure message fortransmission; encrypt the secure message utilizing the second keyset(e.g., application keyset) to generate an encrypted secure message; andprovide the encrypted secure message to the secure device processor fortransmission to a destination device via an intermediate server (e.g.,OTA server) to enable the destination device to decrypt the encryptedsecure message utilizing the second keyset, where the encrypted securemessage is further encrypted by the secure device processor utilizingthe first keyset (e.g., transport keyset), and where the encryptedsecure message is further decrypted by the intermediate server utilizingthe first keyset prior to delivery to the intermediate server. In oneembodiment, the OTA server can re-encrypt a message that the OTA serverreceived from a device before transmitting to another device. In oneembodiment, the OTA server can be an OTA server function, the remotemanagement server can be a remote management server function, and boththe OTA server function and the remote management server function canoperate from a single device or from a group of devices (where eachdevice of the group executes both functions). In another embodiment, theOTA server and the remote management server are separate devices. In oneembodiment, each transport key of the transport keyset can be static ordynamic.

Other embodiments can be used in the subject disclosure.

It should be understood that devices described in the exemplaryembodiments can be in communication with each other via various wirelessand/or wired methodologies. The methodologies can be links that aredescribed as coupled, connected and so forth, which can includeunidirectional and/or bidirectional communication over wireless pathsand/or wired paths that utilize one or more of various protocols ormethodologies, where the coupling and/or connection can be direct (e.g.,no intervening processing device) and/or indirect (e.g., an intermediaryprocessing device such as a router).

FIG. 9 depicts an exemplary diagrammatic representation of a machine inthe form of a computer system 900 within which a set of instructions,when executed, may cause the machine to perform any one or more of themethods described above. One or more instances of the machine canoperate, for example, as the remote management server, the serviceprovisioning system, the OTA server, the secure services platform (e.g.,the secure element and/or the administrative agent function of the SDP),the device processor, and so forth. In some embodiments, the machine maybe connected (e.g., using a network 926) to other machines. In anetworked deployment, the machine may operate in the capacity of aserver or a client user machine in server-client user networkenvironment, or as a peer machine in a peer-to-peer (or distributed)network environment.

The machine may comprise a server computer, a client user computer, apersonal computer (PC), a tablet PC, a smart phone, a laptop computer, adesktop computer, a control system, a network router, switch or bridge,or any machine capable of executing a set of instructions (sequential orotherwise) that specify actions to be taken by that machine. It will beunderstood that a communication device of the subject disclosureincludes broadly any electronic device that provides voice, video ordata communication. Further, while a single machine is illustrated, theterm “machine” shall also be taken to include any collection of machinesthat individually or jointly execute a set (or multiple sets) ofinstructions to perform any one or more of the methods discussed herein.

The computer system 900 may include a processor (or controller) 902(e.g., a central processing unit (CPU)), a graphics processing unit(GPU, or both), a main memory 904 and a static memory 906, whichcommunicate with each other via a bus 908. The computer system 900 mayfurther include a display unit 910 (e.g., a liquid crystal display(LCD), a flat panel, or a solid state display). The computer system 900may include an input device 912 (e.g., a keyboard), a cursor controldevice 914 (e.g., a mouse), a disk drive unit 916, a signal generationdevice 918 (e.g., a speaker or remote control) and a network interfacedevice 920. In distributed environments, the embodiments described inthe subject disclosure can be adapted to utilize multiple display units910 controlled by two or more computer systems 900. In thisconfiguration, presentations described by the subject disclosure may inpart be shown in a first of the display units 910, while the remainingportion is presented in a second of the display units 910.

The disk drive unit 916 may include a tangible computer-readable storagemedium 922 on which is stored one or more sets of instructions (e.g.,software 924) embodying any one or more of the methods or functionsdescribed herein, including those methods illustrated above. Theinstructions 924 may also reside, completely or at least partially,within the main memory 904, the static memory 906, and/or within theprocessor 902 during execution thereof by the computer system 900. Themain memory 904 and the processor 902 also may constitute tangiblecomputer-readable storage media.

Dedicated hardware implementations including, but not limited to,application specific integrated circuits, programmable logic arrays andother hardware devices that can likewise be constructed to implement themethods described herein. Application specific integrated circuits andprogrammable logic array can use downloadable instructions for executingstate machines and/or circuit configurations to implement embodiments ofthe subject disclosure. Applications that may include the apparatus andsystems of various embodiments broadly include a variety of electronicand computer systems. Some embodiments implement functions in two ormore specific interconnected hardware modules or devices with relatedcontrol and data signals communicated between and through the modules,or as portions of an application-specific integrated circuit. Thus, theexample system is applicable to software, firmware, and hardwareimplementations.

In accordance with various embodiments of the subject disclosure, theoperations or methods described herein are intended for operation assoftware programs or instructions running on or executed by a computerprocessor or other computing device, and which may include other formsof instructions manifested as a state machine implemented with logiccomponents in an application specific integrated circuit or fieldprogrammable gate array. Furthermore, software implementations (e.g.,software programs, instructions, etc.) including, but not limited to,distributed processing or component/object distributed processing,parallel processing, or virtual machine processing can also beconstructed to implement the methods described herein. It is furthernoted that a computing device such as a processor, a controller, a statemachine or other suitable device for executing instructions to performoperations or methods may perform such operations directly or indirectlyby way of one or more intermediate devices directed by the computingdevice.

While the tangible computer-readable storage medium 922 is shown in anexample embodiment to be a single medium, the term “tangiblecomputer-readable storage medium” should be taken to include a singlemedium or multiple media (e.g., a centralized or distributed database,and/or associated caches and servers) that store the one or more sets ofinstructions. The term “tangible computer-readable storage medium” shallalso be taken to include any non-transitory medium that is capable ofstoring or encoding a set of instructions for execution by the machineand that cause the machine to perform any one or more of the methods ofthe subject disclosure. The term “non-transitory” as in a non-transitorycomputer-readable storage includes without limitation memories, drives,devices and anything tangible but not a signal per se.

The term “separate” can include a component or device that is logicallyand/or physically separate from another component or device, which caninclude components/devices that operate independently of each otherwhile being in communication with each other. In one or moreembodiments, devices can be separate in that they do not share anycommon component (although such separate devices can be in communicationwith each other such as via an electrode coupling. In one or moreembodiments, devices can be separate in that they each have one or morecomponents that are not shared between each other but have one or morecomponents that may be shared with each other.

The term “tangible computer-readable storage medium” shall accordinglybe taken to include, but not be limited to: solid-state memories such asa memory card or other package that houses one or more read-only(non-volatile) memories, random access memories, or other re-writable(volatile) memories, a magneto-optical or optical medium such as a diskor tape, or other tangible media which can be used to store information.Accordingly, the disclosure is considered to include any one or more ofa tangible computer-readable storage medium, as listed herein andincluding art-recognized equivalents and successor media, in which thesoftware implementations herein are stored.

Although the present specification describes components and functionsimplemented in the embodiments with reference to particular standardsand protocols, the disclosure is not limited to such standards andprotocols. Each of the standards for Internet and other packet switchednetwork transmission (e.g., TCP/IP, UDP/IP, HTML, HTIP, NFC) representexamples of the state of the art. Such standards are from time-to-timesuperseded by faster or more efficient equivalents having essentiallythe same functions. Wireless standards for device detection (e.g.,RFID), short-range communications (e.g., Bluetooth, WiFi, Zigbee, NFC),and long-range communications (e.g., WiMAX, GSM, CDMA, LTE) can be usedby computer system 900.

The illustrations of embodiments described herein are intended toprovide a general understanding of the structure of various embodiments,and they are not intended to serve as a complete description of all theelements and features of apparatus and systems that might make use ofthe structures described herein. Many other embodiments will be apparentto those of skill in the art upon reviewing the above description. Theexemplary embodiments can include combinations of features and/or stepsfrom multiple embodiments. Other embodiments may be utilized and derivedtherefrom, such that structural and logical substitutions and changesmay be made without departing from the scope of this disclosure. Figuresare also merely representational and may not be drawn to scale. Certainproportions thereof may be exaggerated, while others may be minimized.Accordingly, the specification and drawings are to be regarded in anillustrative rather than a restrictive sense.

Although specific embodiments have been illustrated and describedherein, it should be appreciated that any arrangement calculated toachieve the same purpose may be substituted for the specific embodimentsshown. This disclosure is intended to cover any and all adaptations orvariations of various embodiments. Combinations of the aboveembodiments, and other embodiments not specifically described herein,can be used in the subject disclosure. In one or more embodiments,features that are positively recited can also be excluded from theembodiment with or without replacement by another component or step. Thesteps or functions described with respect to the exemplary processes ormethods can be performed in any order. The steps or functions describedwith respect to the exemplary processes or methods can be performedalone or in combination with other steps or functions (from otherembodiments or from other steps that have not been described). Less thanall of the steps or functions described with respect to the exemplaryprocesses or methods can also be performed in one or more of theexemplary embodiments. Further, the use of numerical terms to describe adevice, component, step or function, such as first, second, third, andso forth, is not intended to describe an order or function unlessexpressly stated so. The use of the terms first, second, third and soforth, is generally to distinguish between devices, components, steps orfunctions unless expressly stated otherwise. Additionally, one or moredevices or components described with respect to the exemplaryembodiments can facilitate one or more functions, where the facilitating(e.g., facilitating access or facilitating establishing a connection)can include less than every step needed to perform the function or caninclude all of the steps needed to perform the function.

The Abstract of the Disclosure is provided with the understanding thatit will not be used to interpret or limit the scope or meaning of theclaims. In addition, in the foregoing Detailed Description, it can beseen that various features are grouped together in a single embodimentfor the purpose of streamlining the disclosure. This method ofdisclosure is not to be interpreted as reflecting an intention that theclaimed embodiments require more features than are expressly recited ineach claim. Rather, as the following claims reflect, inventive subjectmatter lies in less than all features of a single disclosed embodiment.Thus the following claims are hereby incorporated into the DetailedDescription, with each claim standing on its own as a separately claimedsubject matter.

What is claimed is:
 1. A method comprising: decrypting, by a secureprocessing system including a processor of a communication system, anover-the-air programming message that includes programming data,utilizing a first keyset obtained by the secure processing system togenerate a first-keyset decrypted over-the-air programming message,wherein the first keyset is obtained from a remote management server viatransmission by an over-the-air programming server; and providing, bythe secure processing system, the first-keyset decrypted over-the-airprogramming message to a secure element, wherein the providing of thefirst-keyset decrypted over-the-air programming message to the secureelement enables the secure element to further decrypt the first-keysetdecrypted over-the-air programming message utilizing a second keyset,and wherein the secure processing system does not have access to thesecond keyset.
 2. The method of claim 1, further comprising:determining, by the secure processing system, a schedule for providingmessages to the secure element of the communication system, wherein thesecure processing system is separate from the secure element and incommunication with the secure element.
 3. The method of claim 1, whereinthe over-the-air programming message originates from a serviceprovisioning system, wherein the over-the-air programming server doesnot have access to the second keyset, and wherein the serviceprovisioning system has access to the second keyset.
 4. The method ofclaim 3, comprising: determining, by the secure processing system, thata response has been generated by the secure element and is associatedwith the over-the-air programming message; and providing, by the secureprocessing system, the response to the over-the-air programming serverfor transmission to the service provisioning system, wherein theresponse is encrypted by the secure element utilizing the second keyset,and wherein the response is configured for decryption by the serviceprovisioning system utilizing the second keyset.
 5. The method of claim1, further comprising: monitoring, by the secure processing system, fora response provided by the secure element; determining, by the secureprocessing system, that the response is associated with the over-the-airprogramming message; encrypting, by the secure processing system, theresponse utilizing the first keyset to generate an encrypted response;and providing, by the secure processing system, the encrypted responseto the over-the-air programming server to enable the over-the-airprogramming server to decrypt the encrypted response for transmission toa service provisioning system.
 6. The method of claim 5, furthercomprising: authenticating, by the secure processing system, with thesecure element utilizing a third keyset; and obtaining, by the secureprocessing system, the first keyset from the secure element, wherein thefirst keyset is generated by the secure element from a static key thatis provided by the remote management server to the secure element and tothe over-the-air programming server.
 7. The method of claim 6, whereinthe providing of the static key to the secure element by the remotemanagement server is based on another over-the-air programming messagethat utilizes short message service transport protocol.
 8. The method ofclaim 1, comprising: providing, by the secure processing system, arequest to the secure element for the first keyset responsive to adetermination that the over-the-air programming message has beenencrypted; and obtaining, by the secure processing system, the firstkeyset from the secure element.
 9. The method of claim 1, comprisingretransmitting, by the secure processing system, the first-keysetdecrypted over-the-air programming message to the secure element.
 10. Anon-transitory, machine-readable storage medium, comprising executableinstructions that, when executed by a processing system including aprocessor, facilitate performance of operations, the operationscomprising: decrypting an encrypted over-the-air programming messagethat includes programming data, utilizing a first keyset at secureprocessing device to generate a first-keyset decrypted over-the-airprogramming message, wherein the first keyset is obtained from a remotemanagement server via transmission by an over-the-air programmingserver; and forwarding the first-keyset decrypted over-the-airprogramming message to a secure element, wherein the forwarding of thefirst-keyset decrypted over-the-air programming message to the secureelement enables the secure element to further decrypt the first-keysetdecrypted over-the-air programming message utilizing a second keyset,and wherein the secure processing device does not have access to thesecond keyset.
 11. The non-transitory, machine-readable storage mediumof claim 10, wherein the encrypted over-the-air programming message isobtained from a service provisioning system, and wherein the encryptedover-the-air programming message is encrypted by the serviceprovisioning system utilizing a second keyset.
 12. The non-transitory,machine-readable storage medium of claim 10, wherein the encryptedover-the-air programming message is provided to the secure processingdevice according to a hypertext transfer protocol.
 13. Thenon-transitory, machine-readable storage medium of claim 10, wherein thefirst-keyset decrypted over-the-air programming message is forwarded tothe secure element according to a provisioning schedule.
 14. Thenon-transitory, machine-readable storage medium of claim 13, wherein theprovisioning schedule is determined by the secure processing device. 15.The non-transitory, machine-readable storage medium of claim 10,comprising: obtaining the encrypted over-the-air programming messagefrom a service provisioning system; obtaining a request from a serviceprovisioning system to provide the encrypted over-the-air programmingmessage to another communication device; determining that the anothercommunication device is not registered with the remote managementserver; and providing a notice to the service provisioning systemindicating that a secure device processor of the another communicationdevice is not registered with the over-the-air programming server. 16.The non-transitory, machine-readable storage medium of claim 10,comprising: obtaining a response to the encrypted over-the-airprogramming message; decrypting the response utilizing the first keysetto generate a first-keyset decrypted response; and providing thefirst-keyset decrypted response to a service provisioning system thatoriginated the encrypted over-the-air programming message.
 17. Acommunication device comprising: a secure processing system including aprocessor; and a memory that stores executable instructions that, whenexecuted by the secure processing system, facilitate performance ofoperations, the operations comprising: decrypting an over-the-airprogramming message utilizing a first key to obtain a first-keydecrypted over-the-air programming message, wherein the over-the-airprogramming message includes programming data for provisioning thecommunication device, and wherein the first key is obtained from aremote device via an over-the-air transmission; and providing thefirst-key decrypted over-the-air programming message to a secureelement, wherein the providing of the first-key decrypted over-the-airprogramming message to the secure element enables the secure element tofurther decrypt the first-key decrypted over-the-air programming messageutilizing a second key, and wherein the secure processing system doesnot have access to the second key.
 18. The communication device of claim17, wherein the operations further comprise: obtaining a static key viaa remote management server, wherein the remote management serverprovides the static key to an over-the-air programming server thatprovides the over-the-air programming message to the secure processingsystem; and generating the first key from the static key.
 19. Thecommunication device of claim 17, wherein the secure element comprises auniversal integrated circuit card, and wherein the over-the-airprogramming message utilizes a hypertext transfer protocol.
 20. Thecommunication device of claim 17, wherein the operations furthercomprise: determining, by the secure processing system, a schedule forproviding messages to the secure element of the communication device,wherein the secure processing system is separate from the secure elementand in communication with the secure element.